CVE-2026-3688
HighCVSS 8.1Summary
The WCFM Membership plugin for WordPress is vulnerable to Insecure Direct Object Reference (IDOR) in versions up to and including 2.11.10. The 'wcfmvm_membership_change' AJAX action fails to validate user permissions to modify other users, allowing authenticated attackers with vendor-level access or higher to change any user's role to 'wcfm_vendor' by altering their membership plan.
Risk Assessment
The organization is at risk of unauthorized privilege escalation, where an attacker can take over other users' accounts by assigning them the vendor role, potentially leading to store integrity compromise and data theft.
Recommendation
Immediately update the WCFM Membership plugin to the latest available version that fixes this vulnerability. If an update is not possible, temporarily disable or restrict access to the 'wcfmvm_membership_change' AJAX action for unauthorized users.
Other vulnerabilities in WCFM Membership
See all- CVE-2026-84756High
Subscriber Privilege Escalation in WCFM Membership versions up to 2.11.11. A user with subscriber role can gain higher privileges.
- CVE-2026-42753High
CVE-2026-42753 describes a missing authorization vulnerability in the WC Lovers WCFM Membership plugin, allowing exploitation of incorrectly configured access control security levels. This issue affects WCFM Membership from n/a through version 2.11.10.
Original NVD description (English source)
The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.11.10. This is due to the 'wcfmvm_membership_change' AJAX action not validating user permission to modify other users. This makes it possible for authenticated attackers, with vendor level access and above, to change any user's role to 'wcfm_vendor' by changing their membership plan.